Unsourced random access (URA) has emerged as a promising paradigm for enabling massive connectivity in Internet-of-Things (IoT) networks. However, since URA transmissions do not contain device identifiers, the receiver may not associate decoded messages with their originating devices, introducing a security vulnerability: forged messages may be decoded as legitimate. To address this problem, this paper proposes a one-hot coding (OHC)-based URA framework that enables message authentication while preserving the unsourced transmission principle. Specifically, distinct messages are mapped onto orthogonal channel uses via an OHC-based common codebook and transmitted using on-off keying modulation. The resulting orthogonal channel structure enables radio-frequency fingerprint identification to authenticate received signals by exploiting device-specific hardware impairments, thereby authenticating decoded messages without introducing an additional authentication payload. Analytical expressions for the per-user probability of error and the probability of successful spoofing are derived. Numerical results demonstrate that the proposed scheme enables secure URA transmission while maintaining reliable communication performance in ultra-short-payload IoT scenarios.